CERT-In Secures Access to Anthropic Mythos AI to Bolster Cyber Defence Testing India's national cybersecurity agency CERT-In has obtained access to Anthropic's Mythos AI model to conduct controlled trials and detect system vulnerabilities under tight oversight. India's national cybersecurity watchdog, CERT-In, has gained access to Anthropic's advanced Mythos AI model, according to IT Ministry sources. The agency is preparing to deploy the sophisticated system under rigorous oversight mechanisms. Officials indicated that the operational plan involves rolling out the model in carefully calibrated phases, with the primary objective of determining safe and effective applications for national cyber defence efforts. Strictly Guarded Access for Threat Evaluation Access to Mythos remains tightly restricted to an exclusive group of vetted organisations. The stringent safeguards stem from concerns that the model's advanced offensive and defensive cyber capabilities could lead to widespread disruption if misused. Before considering any broad deployment, CERT-In intends to conduct extensive evaluations of how the system functions under varied conditions. Securing this access is intended to support the agency in uncovering architectural weaknesses across digital networks while sharpening defensive countermeasures against newly emerging cyber threats. A Deliberate and Controlled Experimental Pace CERT-In plans to initiate its evaluation through tightly confined trials, analysing early results before proceeding further. Sources indicated that the agency will explore how the technology can be deployed most effectively, describing the timeline as intentionally measured. Officials explained that testing will proceed very gradually, routing individual use cases one by one to ensure that risk mitigation remains the overriding priority throughout the initial experimental phase. Ensuring Remedies Do Not Exceed the Threat Sources stressed that this cautious stance is designed to extract maximum technological benefits while actively preventing unintended fallout. The overarching principle guiding the rollout is to ensure that the intervention does not become more damaging than the vulnerability it is designed to address. Regulators will conduct an exhaustive appraisal of the model's capabilities and constraints, alongside a detailed risk assessment regarding potential exploitation. Any subsequent expansion of its operational footprint will depend entirely on findings from these preliminary trials. Navigating the Dual-Use Dilemma of Advanced AI The onboarding of Mythos occurs amidst an intensifying international debate over the dual nature of artificial intelligence in digital security. Highly capable models can rapidly pinpoint code vulnerabilities and formulate patches, yet those identical capabilities provide malicious actors with potent tools to automate intrusions. Sources pointed out that such dual-use characteristics necessitate strict institutional restraint and well-defined safeguards. Independent validation and controlled stress-testing are considered indispensable before critical infrastructure operators rely on such platforms on a wider scale. Sector-Specific Governance and the TRAI Telecom Framework Sources also addressed the Telecom Regulatory Authority of India's draft proposals concerning responsible AI adoption across communications networks. They argued that sector-specific rulebooks are far more practical than blanket mandates because artificial intelligence introduces unique operational dynamics across different industries. Officials noted that AI-driven hazards are considerably more severe in critical infrastructure domains, making it essential for dedicated regulatory bodies like TRAI to spearhead guidelines for their respective sectors. TRAI introduced a draft framework aimed at establishing ethical and accountable AI practices across telecom infrastructure. The regulator recommended that telecom service providers formulate formal AI governance policies ratified by their boards of directors. It also proposed creating specialised safety and oversight committees within operating firms. Under the draft guidelines, service providers would be required to report critical AI-related incidents directly to the authority, establishing unified operating standards across the industry. IT Ministry Prepares Comprehensive AI Consultation Paper Simultaneously, the Ministry of Electronics and Information Technology is drafting an extensive consultation paper to address the broader regulatory landscape for artificial intelligence. According to sources, this initiative will focus on core issues such as algorithmic safety, deepfake proliferation, and human-centric design standards. Officials emphasised that the ministry maintains close coordination with regulators in high-risk domains, acknowledging that critical infrastructure requires heightened security thresholds tailored to specific sector vulnerabilities. Officials cautioned that imposing an inflexible, one-size-fits-all regulatory mandate across every sector could create disproportionate compliance friction. They pointed out that while the IT Ministry holds overarching authority, uniform mandates would inevitably penalise diverse sectors unequally. In sectors classified as critical national infrastructure, heightened restrictions are appropriate, but an overly rigid central policy would constrain benign industries across the broader economy. Consequently, Indian authorities are pairing CERT-In's measured trials of Mythos with a decentralised, sector-by-sector regulatory approach designed to reflect the genuine risk profile of each digital domain. What this means for you The phased integration of advanced AI models by India's cybersecurity agency signals a proactive strengthening of the nation's critical digital infrastructure and consumer data protections. • Across India: National cyber infrastructure will gain improved automated defenses to protect banking, telecom, and citizen services from sophisticated attacks. This strategic testing helps identify network vulnerabilities before hostile actors can exploit them. • For digital consumers: Everyday internet users will benefit from enhanced systemic security protecting personal data and financial systems from advanced automated intrusion techniques. Better defense models minimize the risk of large-scale service disruptions caused by cyber incidents. • In telecom services: Mobile and broadband subscribers will see service providers operate under formal board-approved AI safety frameworks mandated by TRAI. Incidents involving AI failures or security breaches will be systematically tracked and reported to regulators. • For enterprise governance: Technology firms operating across sensitive infrastructure will encounter clear, sector-focused regulatory standards rather than blanket restrictions. Companies will need to establish designated safety committees to monitor automated tools in line with emerging federal guidance. Why this happened This strategic move is driven by the rapid emergence of high-capability artificial intelligence models that carry both defensive security utility and offensive exploitation risks across national infrastructure. • Restricted distribution rationale: Anthropic maintains tight control over Mythos access because its sophisticated features could be repurposed at scale to orchestrate automated cyber intrusions. Granting access to trusted entities like CERT-In enables defensive auditing while preventing malicious proliferation. • The dual-use dilemma: Advanced reasoning models possess the capacity to detect software bugs and suggest patches, but threat actors can exploit the same logic to engineer zero-day vulnerabilities. This dual-use risk led officials to adopt an intentionally slow, step-by-step testing cadence rather than immediate deployment. • Demand for sectoral governance: Regulators recognised that a single universal mandate would penalise lower-risk businesses while failing to sufficiently protect essential utilities. Critical sectors like telecommunications face exponentially higher security consequences, necessitating dedicated rules and reporting structures. Questions & Answers 1. Which AI model has CERT-In secured access to? CERT-In has secured access to the Mythos AI model developed by Anthropic. 2. How will CERT-In utilise the Mythos model? The agency will conduct controlled trials to identify system vulnerabilities and improve response strategies against emerging cyber threats. 3. Why is access to Mythos restricted to a small circle of organisations? Access is restricted due to security concerns that its advanced cyber capabilities could be misused at scale by malicious actors. 4. What has TRAI proposed regarding AI use in telecommunications? TRAI proposed that telecom operators implement board-approved AI policies, form dedicated safety committees, and report critical AI incidents. 5. What issues will the IT Ministry's upcoming consultation paper address? The IT Ministry is preparing a consultation paper addressing AI safety, deepfakes, and human-centric governance principles. https://trendkia.com/en/technology/cert-in-secures-access-to-anthropic-mythos-ai-to-bolster-cyber-defence-testing-55946 TrendKia — Har trend, sabse pehle.